@here We wanted to give this community this upcoming PR from @nm185 (https://github.com/medplum/medplum/pull/3919). This only affects workflows that use the

Bot/:id/$execute

endpoint, and affects how Bots maintain access controls. We haven’t merged the PR yet, but are planning on doing so by end of week. *Before: * Bot/:id/$execute would run with the permissions of the endpoint caller AccessPolicy on the Bot’s ProjectMembership were ignored. *After: * The access of the bot when calling Bot/:id/$execute depends on whether the Bot.runAsUser flag is set: Bot.runAsUser===true: The bot runs with the access level of the calling user Bot.runAsUser===false or Bot.runAsUser===undefined: The bot runs according to it’s given AccessPolicy, if any *Migration: * The simplest thing to do is to set the Bot.runAsUser flag on your existing Bots, to ensure the same behavior. *Impact: * We did an analysis over the last 2 months, and didn’t see any such calls to your production project, but there were a few to your Development Project Let me know if you’ve got any questions! And thank you to @nm185 for the contribution!